Is the talent shortage in IT impeding the fight against ransomware?

Question

Answer

There is a lack of people who truly understand cybersecurity well, and only the largest companies can afford that top talent—even though they've been attacked as well, as we can see on the news. For smaller and medium-sized businesses (SMBs), it's very challenging. We hear about lots of ransomware attacks on government, local, and state agencies. Those agencies do not pay the most money; therefore, they don't attract the best talent. If you don't attract the best talent, your network, systems, and all your data is more vulnerable. Maybe that's making ransomware even more difficult to mitigate or at least minimize.

Answer

Having run IT teams in midsize companies, you can't have the best of everything, so that is a challenge. And if you happen to get top talent or you happen to train one up, they go somewhere else and then you're starting over. The question is, how do you buy top talent when you need them? Maybe the answer to that is to work with a cybersecurity firm and establish that relationship before you actually need them.

Answer

I think one of the challenges is that nowadays we have half-baked Security professionals out there. Don't get me wrong, there are tons of great experienced folks, but as there is such a shortage in this profession we see many who become so-called Security Pros overnight by attending 6 weeks to few months college program, or converts from other professions, while there are successful stories, you see someone working as a bank clerk for 5 years and then realized that Security makes more money, went to the local college and passed Security +, and you hire him as Security Analyst, the poor guy does not know the difference between TCP and UDP and have no idea what VLAN is. How can you expect that he can protect the network or the system?

There is a shortage of good talent, the great talent is hired by big companies, and we have half-backed security admins that small to medium businesses can afford, so they hire what's available.

To be a good security admin you need to preferably be a good network or system admin before, you need to understand the underlying technology stack to be able to protect it.

The same story goes with higher-level positions, you have SAP consultants who realized that their profession is dying and went and got CISSP and then want to be CISOs. So yeah, ransomware will continue happening...

Is the talent shortage in IT impeding the fight against ransomware?

Content you might like

Which EDR has less false positives?

If you had a magic wand - what's the #1 daily business challenge you'd eliminate?